release: 7.72.1 by metamaskbot · Pull Request #28679 · MetaMask/metamask-mobile

metamaskbot · 2026-04-10T15:57:48Z

🚀 v7.72.1 Testing & Release Quality Process

Hi Team,
As part of our new MetaMask Release Quality Process, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.

📋 Key Processes

Testing Strategy

Developer Teams:
Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
QA Team:
Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
Customer Success Team:
Validate new functionalities and provide feedback to support release monitoring.

GitHub Signoff

Each team must sign off on the Release Candidate (RC) via GitHub by the end of the validation timeline (Tuesday EOD PT).
Ensure all tests outlined in the Testing Plan are executed, and any identified issues are addressed.

Issue Resolution

Resolve all Release Blockers (Sev0 and Sev1) by Tuesday EOD PT.
For unresolved blockers, PRs may be reverted, or feature flags disabled to maintain release quality and timelines.

Cherry-Picking Criteria

Only critical fixes meeting outlined criteria will be cherry-picked.
Developers must ensure these fixes are thoroughly reviewed, tested, and merged by Tuesday EOD PT.

🗓️ Timeline and Milestones

Today (Friday): Begin Release Candidate validation.
Tuesday EOD PT: Finalize RC with all fixes and cherry-picks.
Wednesday: Buffer day for final checks.
Thursday: Submit release to app stores and begin rollout to 1% of users.
Monday: Scale deployment to 10%.
Tuesday: Full rollout to 100%.

✅ Signoff Checklist

Each team is responsible for signing off via GitHub. Use the checkbox below to track signoff completion:

Team sign-off checklist

Mobile Platform

This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀

Feel free to reach out if you have questions or need clarification.

Many thanks in advance

Reference

Testing plan sheet - https://docs.google.com/spreadsheets/d/1tsoodlAlyvEUpkkcNcbZ4PM9HuC9cEM80RZeoVv5OCQ/edit?gid=404070372#gid=404070372

github-actions · 2026-04-10T16:36:58Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

)  ## **Description** CI is failing on `yarn audit:ci` due to a critical severity advisory ([GHSA-3p68-rc4w-qgx5](GHSA-3p68-rc4w-qgx5)) in axios < 1.15.0. The vulnerability allows an attacker to bypass `NO_PROXY` hostname normalization, leading to SSRF. This PR bumps axios from 1.13.5 to 1.15.0 across `dependencies`, `resolutions`, and the CI scripts package. Because 1.15.0 was published less than 3 days ago, it is also temporarily added to `npmPreapprovedPackages` in `.yarnrc.yml` to bypass the `npmMinimalAgeGate`. This preapproval entry should be removed after 2025-04-12. ## **Changelog**  CHANGELOG entry: null ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: my feature name Scenario: user [verb for user action] Given [describe expected initial app state] When user [verb for user action] Then [describe expected outcome] ``` ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Updates a widely used HTTP client to remediate a critical SSRF advisory; moderate risk due to potential subtle networking/proxy behavior changes across the app and CI scripts. > > **Overview** > **Bumps `axios` from `^1.13.5` to `^1.15.0` across the repo** (app `dependencies`, `resolutions`, and the `.github/scripts` workspace) to address the flagged security advisory. > > Updates both lockfiles to the new `axios` and its transitive `proxy-from-env@^2.1.0`, and temporarily adds `axios` to `.yarnrc.yml` `npmPreapprovedPackages` to bypass the 3-day `npmMinimalAgeGate` for this release. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 34350ca. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

## **Description** Bumps `@xmldom/xmldom` from `^0.8.10` to `^0.8.12` to address the failing production dependency audit (`GHSA-wh4c-j3r5-mjhp`). ## **Changelog** CHANGELOG entry: null ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: Production dependency audit compliance Scenario: audit CI passes after xmldom patch update Given the repository is on branch chore/fix-audit-xmldom When I run yarn audit:ci Then no audit suggestions are reported ``` ## **Screenshots/Recordings** ### **Before** N/A (dependency-only change) ### **After** N/A (dependency-only change) ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Low Risk** > Low risk dependency-only update; main risk is unexpected behavior changes in XML parsing due to the transitive library patch bump. > > **Overview** > Updates the production dependency `@xmldom/xmldom` from `^0.8.10`/`0.8.11` to `^0.8.12` and refreshes `yarn.lock` to lock the new resolved version/checksum, addressing the flagged security advisory. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 776772f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…ce gate on Market Insights Long/Short actions (#28688) - fix(perps): enforce geo-block and compliance gate on Market Insights Long/Short actions cp-7.72.1 (#28678) ## **Description** The `MarketInsightsView` (AI summaries page) Long/Short buttons navigated directly to `PerpsOrderRedirect` without checking geo-eligibility or running the compliance gate. This allowed users in restricted regions to bypass restrictions and open perps positions from the Market Insights entry point, even though every other entry point (Market Details, Order Book, Token Details) correctly blocked them. **Changes:** - Wrapped `handlePerpsDirectionPress` in the compliance `gate()` and added the `isEligible` geo-check before navigation, matching the pattern in `PerpsMarketDetailsView` and `AssetOverviewContent` - Renders the `PerpsBottomSheetTooltip` geo-block modal ("Perps unavailable in your region") when the user is ineligible - Added `MARKET_INSIGHTS` to `PERPS_EVENT_VALUE.SOURCE` for proper geo-block analytics attribution - Updated existing tests and added a new test case for the ineligible scenario ## **Changelog** CHANGELOG entry: Fixed a bug where users in restricted regions could open perps positions from the Market Insights page ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: Perps geo-block enforcement on Market Insights Scenario: Restricted user taps Long on Market Insights Given the user is in a geo-restricted region And the user navigates to Market Insights for a perps asset (e.g. ETH) When the user taps the "Long" button Then the "Perps unavailable in your region" modal is shown And the user is NOT navigated to the order screen Scenario: Restricted user taps Short on Market Insights Given the user is in a geo-restricted region And the user navigates to Market Insights for a perps asset When the user taps the "Short" button Then the "Perps unavailable in your region" modal is shown And the user is NOT navigated to the order screen Scenario: Eligible user taps Long on Market Insights Given the user is NOT in a geo-restricted region And the user navigates to Market Insights for a perps asset When the user taps the "Long" button Then the user is navigated to the order screen as expected ``` ## **Screenshots/Recordings** N/A — behavior matches existing geo-block modal shown on other Perps entry points. ### **Before** Tapping Long/Short on Market Insights in a restricted region navigated to the order screen (bypassing restrictions). ### **After** <img width="1320" height="2868" alt="Simulator Screenshot - iPhone 17 Pro Max - 2026-04-10 at 17 46 41" src="https://github.com/user-attachments/assets/6d9e4b9f-2d69-4b4a-9bd2-13ee053bc26d" /> Tapping Long/Short on Market Insights in a restricted region shows the geo-block modal and blocks navigation. ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Touches Perps eligibility/compliance gating and navigation from `MarketInsightsView`, so mistakes could reintroduce a restriction bypass or block eligible users; changes are localized and covered by updated tests. > > **Overview** > Prevents the Market Insights Perps `Long`/`Short` CTAs from navigating directly to order flow without restrictions by wrapping the action in the compliance `gate()` and checking `selectPerpsEligibility` first. > > When ineligible, it now tracks a geo-block screen view with source `PERPS_EVENT_VALUE.SOURCE.MARKET_INSIGHTS` and shows the `PerpsBottomSheetTooltip` in a modal instead of navigating. Tests were updated to handle async gated presses and a new test asserts the ineligible geo-block behavior; the Perps view test renderer also ensures extra routes get the same Perps providers. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8ed8908. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Javier Garcia Vera <javier.vera@consensys.net> Co-authored-by: javiergarciavera <76975121+javiergarciavera@users.noreply.github.com> Co-authored-by: Alejandro Garcia <alejandro.garcia@consensys.net> Co-authored-by: Nicholas Gambino <nicholas.gambino@consensys.net> [90f34c6](90f34c6) --------- Co-authored-by: Michal Szorad <michal.szorad@consensys.net> Co-authored-by: Javier Garcia Vera <javier.vera@consensys.net> Co-authored-by: javiergarciavera <76975121+javiergarciavera@users.noreply.github.com> Co-authored-by: Alejandro Garcia <alejandro.garcia@consensys.net> Co-authored-by: Nicholas Gambino <nicholas.gambino@consensys.net> Co-authored-by: João Loureiro <175489935+joaoloureirop@users.noreply.github.com>

…ity (#28620)" This reverts commit e80aaac.

This reverts commit 309af20.

…cal SSRF vulnerability (#28717) - fix: bump axios to 1.15.0 to resolve critical SSRF vulnerability (#28620)  ## **Description** CI is failing on `yarn audit:ci` due to a critical severity advisory ([GHSA-3p68-rc4w-qgx5](GHSA-3p68-rc4w-qgx5)) in axios < 1.15.0. The vulnerability allows an attacker to bypass `NO_PROXY` hostname normalization, leading to SSRF. This PR bumps axios from 1.13.5 to 1.15.0 across `dependencies`, `resolutions`, and the CI scripts package. Because 1.15.0 was published less than 3 days ago, it is also temporarily added to `npmPreapprovedPackages` in `.yarnrc.yml` to bypass the `npmMinimalAgeGate`. This preapproval entry should be removed after 2025-04-12. ## **Changelog**  CHANGELOG entry: null ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: my feature name Scenario: user [verb for user action] Given [describe expected initial app state] When user [verb for user action] Then [describe expected outcome] ``` ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Updates a widely used HTTP client to remediate a critical SSRF advisory; moderate risk due to potential subtle networking/proxy behavior changes across the app and CI scripts. > > **Overview** > **Bumps `axios` from `^1.13.5` to `^1.15.0` across the repo** (app `dependencies`, `resolutions`, and the `.github/scripts` workspace) to address the flagged security advisory. > > Updates both lockfiles to the new `axios` and its transitive `proxy-from-env@^2.1.0`, and temporarily adds `axios` to `.yarnrc.yml` `npmPreapprovedPackages` to bypass the 3-day `npmMinimalAgeGate` for this release. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 34350ca. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  [f8a6fb8](f8a6fb8) --------- Co-authored-by: Wei Sun <wei.sun@consensys.net> Co-authored-by: georgewrmarshall <george.marshall@consensys.net>

This PR updates the changelog for **7.72.1**. ## Summary - Adds `## [7.72.1]` with the user-facing fix from [#28688](#28688) (Perps geo-block / compliance gate on Market Insights Long/Short). - Updates footer compare links: `[Unreleased]` → `v7.72.1...HEAD`; `[7.72.1]` → `v7.71.1...v7.72.1`. Hotfix — no test plan generated (documentation only). CHANGELOG entry: null  --- > [!NOTE] > **Low Risk** > Low risk documentation-only change updating `CHANGELOG.md` with the 7.72.1 entry and compare links. > > **Overview** > Adds a new `## [7.72.1]` changelog section documenting a single fix for preventing users in restricted regions from opening Perps positions via Market Insights. > > Updates the changelog footer links so `[Unreleased]` compares from `v7.72.1` and adds the `v7.72.0...v7.72.1` compare link for the new release. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b392d07. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

Resolve CHANGELOG.md: keep ## [7.72.1] hotfix section and stable 7.72.0 content; footer Unreleased v7.72.1...HEAD, [7.72.1] v7.72.0...v7.72.1, [7.72.0] unchanged. Made-with: Cursor

github-actions · 2026-04-13T10:01:21Z

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - base branch is not main or a release branch (base: stable)

All E2E tests pre-selected.

View GitHub Actions results

github-actions · 2026-04-13T10:21:14Z

✅ E2E Fixture Validation — Schema is up to date
18 value mismatches detected (expected — fixture represents an existing user).
View details

sonarqubecloud · 2026-04-13T10:27:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

bump semvar version to 7.72.1 && build version to 4442

aa5f0dc

metamaskbot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Apr 10, 2026

github-actions Bot added the size-S label Apr 10, 2026

bump version only for ota

f444162

github-actions Bot added size-XS and removed size-S labels Apr 10, 2026

weitingsun and others added 4 commits April 10, 2026 19:53

Revert "fix: bump axios to 1.15.0 to resolve critical SSRF vulnerabil…

24ff693

…ity (#28620)" This reverts commit e80aaac.

github-actions Bot added size-M and removed size-XS labels Apr 10, 2026

Revert "chore(deps): bump @xmldom/xmldom to 0.8.12 (#28424)"

fa0ae67

This reverts commit 309af20.

joaoloureirop marked this pull request as ready for review April 10, 2026 20:23

joaoloureirop requested a review from a team as a code owner April 10, 2026 20:23

joaoloureirop previously approved these changes Apr 10, 2026

View reviewed changes

chloeYue dismissed joaoloureirop’s stale review via c1085e7 April 13, 2026 09:07

chloeYue requested a review from a team as a code owner April 13, 2026 09:07

chloeYue previously approved these changes Apr 13, 2026

View reviewed changes

chloeYue dismissed their stale review via 6718e53 April 13, 2026 09:57

Merge branch 'stable' into release/7.72.1

215db7b

Resolve CHANGELOG.md: keep ## [7.72.1] hotfix section and stable 7.72.0 content; footer Unreleased v7.72.1...HEAD, [7.72.1] v7.72.0...v7.72.1, [7.72.0] unchanged. Made-with: Cursor

chloeYue approved these changes Apr 13, 2026

View reviewed changes

chloeYue merged commit 49259e8 into stable Apr 13, 2026
206 of 216 checks passed

chloeYue deleted the release/7.72.1 branch April 13, 2026 12:14

github-actions Bot locked and limited conversation to collaborators Apr 13, 2026

chloeYue restored the release/7.72.1 branch April 14, 2026 07:07

metamaskbot added the release-7.72.1 Issue or pull request that will be included in release 7.72.1 label Apr 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

release: 7.72.1#28679

release: 7.72.1#28679
chloeYue merged 10 commits intostablefrom
release/7.72.1

metamaskbot commented Apr 10, 2026

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

metamaskbot commented Apr 10, 2026

🚀 v7.72.1 Testing & Release Quality Process

📋 Key Processes

Testing Strategy

GitHub Signoff

Issue Resolution

Cherry-Picking Criteria

🗓️ Timeline and Milestones

✅ Signoff Checklist

Team sign-off checklist

Reference

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026

🔍 Smart E2E Test Selection

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants